This question already has an answer here:
I really don't know much about HTTPS. But I always hear people saying that it is 100% safe and bullet proof.
My question is: Is that true or even possible.
I mean there are lots of tools that allow you to read the internet traffic of all other devices that are in the same network as you.
So how do certificates and encryption help to make this bullet proof?
Wouldn't it always be possible to decrypt the HTTPS packets just like the client does?
I mean there must be some kind of key that both parties (Client and Server) must be aware of to be able to en/decrypt data properly, so whoever creates the key has to send it to the other party. Shouldn't a network sniffer be able to pick that up?